Entry product
4-week assessment
AI readiness and governance: understand where you stand and what to do next.
What you receive
Many organisations already use AI, but have no clear view of all its uses, of the data it reaches, or of who answers for its results.
AGORA surveys the initiatives within the agreed scope, assesses the organisation's readiness, and turns findings into concrete decisions. In four weeks we deliver an assessment and a prioritised roadmap for the next 90 days.
Visibility
Understand where and how AI is being used across the cases surveyed.
Control
Identify risks, ownership, and gaps in data and governance.
Decision
Decide what to continue, what to correct and what to prioritise in a 90-day roadmap.
The six deliverables
- AI Inventory
- Maturity Score
- Risk Heatmap
- Governance Gaps
- Data Readiness
- 90-Day Roadmap
What it is, and what it is not
This is not an independent audit or a certification. It is consulting work: it organises readiness and sets out, in writing, what is missing and in what order.
Four maturity levels
The assessment places the organisation on one of these levels, with the evidence behind it.
- G0Informal
- G1Defined
- G2Managed
- G3Optimised
What counts as evidence
What counts is what is documented: the register of AI systems, the approved policy, impact assessments and vendor reviews.
See the full scale in the frameworkWhat each deliverable looks like
The examples below are fictional and labelled as such. None come from a client: they exist so you can see the shape of what you receive, not to suggest results.
Illustrative example · fictional data
AI inventory
Which systems are in use, who is accountable for each, and what data they work with. It is usually the first time the organisation sees it in a single table.
| Use case | Owner | Type | Data used | Criticality | Risk | Governance |
|---|---|---|---|---|---|---|
| Customer response assistant | Customer service | Generative AI | Ticket history | High | High | No policy |
| Collections prioritisation | Finance | Predictive model | Receivables | Medium | Medium | Partial |
| Technical documentation summary | Engineering | Generative AI | Internal repository | Low | Low | Covered |
| Candidate screening | Human resources | Classification | Résumés | High | High | No policy |
| Predictive maintenance | Operations | Time series | Plant telemetry | High | Medium | Partial |
Illustrative example · fictional data
Maturity level
Where the organisation stands today in each dimension, on the framework's scale.
- Governance architectureG1
- Risk and impact managementG1
- Transparency and auditG0
- Privacy and data protectionG2
- Security and resilienceG2
- Third parties and supply chainG0
G0 informal · G1 defined · G2 managed · G3 optimised. The level describes a state; it does not grade anyone.
Illustrative example · fictional data
Risk heatmap
Where exposure concentrates. Each cell counts use cases, not a score: the number says how many systems fall there.
Impact on the affected person
| Low | Medium | High | |
|---|---|---|---|
| High | 0 · Impact on the affected person High · Likelihood of occurrence Low | 11 · Impact on the affected person High · Likelihood of occurrence Medium | 22 · Impact on the affected person High · Likelihood of occurrence High |
| Medium | 11 · Impact on the affected person Medium · Likelihood of occurrence Low | 22 · Impact on the affected person Medium · Likelihood of occurrence Medium | 11 · Impact on the affected person Medium · Likelihood of occurrence High |
| Low | 22 · Impact on the affected person Low · Likelihood of occurrence Low | 11 · Impact on the affected person Low · Likelihood of occurrence Medium | 0 · Impact on the affected person Low · Likelihood of occurrence High |
Likelihood of occurrence
The impact axis measures consequences for whoever receives the decision, not for the project.
Illustrative example · fictional data
Governance gaps
What is missing to hold the next level, by catalogue chapter.
- Not coveredGovernance architectureNo decision body constituted and no owners per use case.
- PartialRisk and impact managementA risk register exists, without classification by consequence for the affected person.
- Not coveredTransparency and auditAssisted decisions leave no reconstructable trace.
- CoveredPrivacy and data protectionLegal bases identified and a retention policy in force.
- CoveredSecurity and resilienceBaseline applied and credential management documented.
- Not coveredThird parties and supply chainNo AI clauses in vendor contracts.
Illustrative example · fictional data
Data readiness
Whether the data feeding each use case can actually support it: who owns it, what quality controls apply, whether it can be traced, and on what legal basis it is held.
| Data source | Owner | Quality | Traceability | Legal basis and retention |
|---|---|---|---|---|
| Support ticket historyCustomer response assistant | Fit for use | Partial | Not covered | Not covered |
| Accounts receivableCollections prioritisation | Fit for use | Fit for use | Partial | Fit for use |
| Internal repositoryTechnical documentation summaries | Partial | Partial | Fit for use | Fit for use |
| RésumésCandidate screening | Not covered | Not covered | Not covered | Partial |
| Plant telemetryPredictive maintenance | Fit for use | Partial | Fit for use | Fit for use |
- Fit for use
- Partial
- Not covered
The crossing that matters: the least prepared source —résumés— feeds the most critical use case in the inventory. Read separately, neither board shows it.
Illustrative example · fictional data
90-day roadmap
What to do, in what order, and who answers for it. What comes first is not the biggest item: it is what reduces exposure fastest.
0–30 days
Immediate controls
- Freeze any use without an assigned owner
- Classify by risk the cases already in production
- Publish a baseline rule for AI use
31–60 days
Ownership and policy
- Constitute the decision body
- Assign an owner per use case
- Define which actions require human confirmation
61–90 days
Data and monitoring
- Inventory the sources feeding critical cases
- Instrument decision traceability
- Agree the review cadence
The four weeks
Where it fits in the journey 02 Assess03 Prioritise
Week 1
Understand & inventory
Which AI systems are in use, who uses them and with what data. It is usually the first time the organisation sees it together.
1 / 4Activities, participants and output · Week 1
- Activities
- Initial alignment with leadership on what needs solving
- Survey of use cases in production and in pilot
- Interviews with the areas that already put systems to work
- Who takes part
- Executive sponsor
- Business
- Technology
- What is reviewed
- Tools contracted and in use
- Existing documentation for each case
- Current access and permissions
- What it closes with
- Initial AI landscape
Week 2
Assess
The state of the data feeding each case, the rules in force, ownership, and the controls that already exist.
2 / 4Activities, participants and output · Week 2
- Activities
- Review of the data sources involved
- Identifying ownership by decision, not by department
- Comparing existing controls against the catalogue
- Who takes part
- Data
- Technology
- Risk, Legal or Compliance
- What is reviewed
- Internal policies and standards in force
- Vendor contracts
- Records of decisions and approvals
- What it closes with
- Assessment findings
Week 3
Prioritise
Which gaps are material, which risks are urgent, and in what order they are worth resolving.
3 / 4Activities, participants and output · Week 3
- Activities
- Placement on the G0–G3 scale with the evidence behind it
- Risk classification by consequence for the affected person
- Ordering by impact, effort and dependencies
- Who takes part
- Business
- Risk, Legal or Compliance
- Executive sponsor
- What is reviewed
- Findings from the previous week
- Priorities stated by the business
- What it closes with
- Prioritised findings
Week 4
Decide
What to do, in what order, with which owners, and what decisions leadership has to make.
4 / 4Activities, participants and output · Week 4
- Activities
- Building the 90-day roadmap with named owners
- Executive readout covering the pending decisions
- Defining the next-step options
- Who takes part
- Executive sponsor
- Business
- Technology
- Data
- What is reviewed
- Everything gathered over the previous three weeks
- What it closes with
- Decision package
Not every organisation needs every role in every week. The list describes where the information usually comes from, not a calendar requirement.
What reaches the board
What closes the fourth week is not a report to file. The six pieces are arranged around the decisions the board has to take, and each decision arrives with the evidence behind it.
The decisions left on the table
Which use cases continue, which are paused and which stop.
Supported by: AI inventory · Risk heatmap
Who answers for each system already in use.
Supported by: Governance gaps
Which data has to be made fit for use before scaling.
Supported by: Data readiness
What gets funded over the next 90 days, and who owns it.
Supported by: 90-day roadmap · Maturity level
Next-step options are defined in that same session, with the board in the room. None of them requires engaging AGORA.
Two ways to start
One orients; the other decides. The quick one does not replace the assessment, and saying otherwise would be selling smoke.
| Two ways to start | Free assessment12 questions · professional review · personalised response | 4-week assessmentAI readiness and governance · evidence-based · fixed price |
|---|---|---|
| Starting point | What you declare in the questionnaire | Evidence gathered in your organisation |
| Professional review | ✓ Included | ✓ Included |
| Preliminary orientation | ✓ Included | ✓ Included |
| Formal AGORA maturity assessment | — Not included | ✓ Included |
| AI inventory | — Not included | ✓ Included |
| Risk heatmap | — Not included | ✓ Included |
| Governance gaps | — Not included | ✓ Included |
| Data readiness | — Not included | ✓ Included |
| 90-day roadmap | — Not included | ✓ Included |
| Executive readout | — Not included | ✓ Included |
Free assessment
12 questions · professional review · personalised response
- Starting point
- What you declare in the questionnaire
Included
- Professional review
- Preliminary orientation
Not included
- Formal AGORA maturity assessment
- AI inventory
- Risk heatmap
- Governance gaps
- Data readiness
- 90-day roadmap
- Executive readout
4-week assessment
AI readiness and governance · evidence-based · fixed price
- Starting point
- Evidence gathered in your organisation
Included
- Professional review
- Preliminary orientation
- Formal AGORA maturity assessment
- AI inventory
- Risk heatmap
- Governance gaps
- Data readiness
- 90-day roadmap
- Executive readout
Who it is for
For organisations that already have AI running and need to decide what to do about it, not for those weighing whether to start.
- Leadership has to answer for decisions a system now makes, and has nothing to answer with.
- Tools are in use that arrived through different areas, without a single decision behind them.
- It operates in a regulated context, or with data whose exposure carries consequences.
- A pilot worked and scaling it raised questions that did not matter before.
It may not be the right fit if…
- What you need is someone to build a model or a system.
- You are looking to add technical people to a team that already knows what to do.
- You need an independent audit or a formal certification.
The first is done better by technical teams; the last, by an accredited body. Saying so upfront saves us both a meeting.
Why AGORA
We do not sell the tool that would then have to be governed
We do not resell platforms or licences. That removes the conflict of recommending what suits us to sell.
The person who talks to leadership leads the work
There is no junior team executing behind a proposal signed by someone else.
Our own framework, not a generic template
A catalogue of 325 controls mapped from ISO/IEC 42001, the EU AI Act and NIST AI RMF, selected in proportion to context.
We say what we do not do
We do not audit or certify. We leave the organisation ready to present itself to whoever does.
What happens next
The roadmap is yours and works whether or not you continue with us. That is not generosity: an assessment you can only act on by hiring whoever produced it is not an assessment, it is a sales proposal in disguise.
- You execute it with your own teams
- The plan is written with owners and sequence. If the capability is in-house, nobody else is needed.
- You continue with one specific stage
- Govern, operationalise or monitor and scale, according to what the assessment itself prioritised. The journey stages are not compulsory.
- You do nothing for now
- That is a decision too, and it is better made knowing what is being deferred.